InsideAn Exposed Docker Daemon Is Root on the Host
Topic 16 of my Kubernetes journey: why an exposed Docker daemon means root on the host, the 2375 vs 2376 ports, and locking it down with TLS and client certs.
Topic 16 of my Kubernetes journey: why an exposed Docker daemon means root on the host, the 2375 vs 2376 ports, and locking it down with TLS and client certs.
Topic 5 of my Kubernetes journey: what CIS Benchmarks actually are, why they matter for hardening a cluster, and how to score yours with Kube-Bench.
Topic 24 of my Kubernetes journey: what a Linux syscall is, why containers share one kernel, and how to watch them live with strace and Aqua Tracee (eBPF).
A clear mental model of Kubernetes: the control plane, worker nodes, pods, deployments, services and why each matters for security testing.
A beginner-friendly introduction to Kubernetes (K8s): what it is, why it's used, and the start of my Kubernetes security journey.
Topic 14 of my Kubernetes journey: pods talk to everything by default. Learn network policies, ingress and egress, labels and selectors, and the AND/OR gotcha.
Topic 19 of my Kubernetes journey: least privilege as system hardening, applied to the node and to RBAC, with a hands-on lab to trim ports, modules and access.
Topic 17 of my Kubernetes journey: what node objects leak (kubelet and kernel versions, internal IPs, taints), why attackers love it, and how to lock it down.
Topic 4 of my Kubernetes journey: the 4Cs of cloud native security explained, then a real attack chain from an open Docker port to a rigged poll database.
The complete Kubernetes security journey mapped end to end: 42 topics from RBAC to runtime, organised by the attacker's path and by defence, with the pentest notes.
Topic 13 of my Kubernetes journey: verify platform binaries with SHA-512 before you trust them, understand version skew, and upgrade a cluster with kubeadm.
Topic 18 of my Kubernetes journey: how audit logging records who did what in your cluster, the four policy levels, a hands-on kind lab, and what to alert on.